What a Illinois business has to have in writing

Write and send notice to affected Illinois residents in the most expedient time possible and without unreasonable delay, describing what happened, what data was involved, contact details for the business and the credit bureaus, and free credit report information. When more than 500 Illinois residents are notified, file a written report with the Attorney General no later than when consumers are notified.

Put reasonable security measures in place to protect personal information from unauthorized access, require the same by contract from vendors that get the data, and dispose of records so that personal information cannot be read or reconstructed. Illinois does not prescribe a single written program format, so businesses document their own safeguards.

Publish a written policy, available to the public, that sets a retention schedule and destruction guidelines for biometric identifiers, with destruction no later than when the purpose ends or three years after the last interaction, whichever is first. Before collecting, tell the person in writing what is collected, why and for how long, and get a written release. Never sell or profit from the data, and protect it at least as well as other confidential information.

Run sexual harassment prevention training that meets the state model every calendar year for all employees, including short-term and part-time staff, and keep records of who was trained. Restaurants and bars must additionally give every employee a written sexual harassment policy in English and Spanish within the first week of work and run supplemental industry-specific training. Employers must also report adverse harassment or discrimination judgments to the Department of Human Rights each year.

Adopt a written workplace violence prevention program built on worksite analysis and hazard identification, with management commitment and worker participation, training, incident reporting and post-incident services; post notices in the facility stating that verbal aggression and physical assault are not tolerated and that assaults are reported to law enforcement; do not have any policy that discourages workers from contacting police or the Department of Public Health.

Build and keep a written information security program driven by a risk assessment, with designated responsibility, vendor oversight, a written incident response plan and reporting to the board; file an annual written certification of compliance with the Director of Insurance, and notify the Director of a cybersecurity event within three business days.

A procurement condition, not a statute. The Cloud Hosting Appendix attaches to state cloud contracts and makes the vendor certify it has had an independent SSAE-18 third-party audit and hand over a SOC 2 Type 2 report at award and every year afterwards, with bridge or gap letters; the state may accept an alternative report only at its discretion. Vendors touching state financial information owe an annual SOC 1 Type 2 report as well. Separately, the vendor must enrol in the Department of Innovation and Technology's Third-Party Risk Management programme at onboarding and answer its questionnaires and document requests for ongoing risk monitoring. Encryption at rest and in transit must be FIPS 140 compliant using AES-256 with proof supplied, media sanitisation follows NIST SP 800-88 with a signed written certificate, and breaches go to the State Chief Information Security Officer within 24 hours. Illinois does not require a GovRAMP or FedRAMP authorization, though the Office of Comptroller is a GovRAMP participating organization.

Give employees at least 40 hours of paid leave a year usable for any reason, accrued at one hour per 40 worked or frontloaded, post the Department of Labor paid leave notice, and give employees written notice of the policy. An employer that writes its own policy must put it in writing and give a copy to employees, and any frontloading or carryover choice has to be documented. Keep three years of leave records.

Give employees who are victims of domestic, sexual or gender-based violence, or whose family member is, unpaid job-protected leave and reasonable safety accommodations; post and give employees the Department of Labor VESSA notice explaining these rights; keep any certification and related information confidential.

Display the Department of Labor's required poster set (minimum wage, equal pay, day of rest, paid leave, VESSA, child labor, employment eligibility verification, whistleblower and safety notices) at each worksite, and give the same notices in writing or by email to employees who work remotely.

Put the wage or salary range and a general description of benefits and other compensation into every covered job posting, including postings a third party runs; keep records of the pay scale and postings for at least five years; and announce promotion opportunities to current employees within 14 days of posting the job externally.

Apply to the Department of Labor for an Equal Pay Registration Certificate, pay the fee, submit employee-level pay data by sex, race and ethnicity along with the EEO-1, and sign a statement from a corporate officer certifying compliance with equal pay and anti-discrimination law and describing how the business sets wages and benefits. Recertify every two years.

File articles of incorporation or organization, or a foreign qualification, with the Secretary of State's Department of Business Services, appoint an Illinois registered agent, register any assumed name with the county, and file the annual report and franchise tax before the anniversary month.

Hold a permit from the local health department, pass inspections, and keep at least one Certified Food Protection Manager on staff who has passed an ANSI-accredited exam and holds the Illinois certificate; post or produce the certificate for the inspector and keep a person in charge on duty at all times.

Make sure each food handler completes an ANSI-accredited food handler training course within 30 days of starting and renews it every three years, and keep the certificates on file at the establishment for inspectors.

Hold an IDFPR roofing contractor license in the correct class before bidding or working, name a qualifying party who passed the exam, carry the required insurance, renew and complete continuing education, and put the license number on contracts, bids, vehicles and advertising.

Give every benefits-eligible employee a written list of the benefits the group plan covers, formatted so it can be compared line by line with the essential health benefits Illinois requires of individual coverage. Deliver it at hire, once a year after that, and whenever an employee asks. The Department of Insurance publishes the comparison list to use.

Post the required notices about employment eligibility verification where employees and applicants can see them, follow set written steps when a verification notice arrives (including written notice to the employee), and do not require social media passwords or penalize workers for lawful off-duty products such as tobacco or, in most cases, cannabis.

Let employees inspect and copy their personnel records, including employment-related contracts, handbooks and written policies, at least twice a year, within seven working days of a written request; respond in writing when a request is denied; and remove disciplinary records older than four years before disclosing them to a third party.